From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752527AbdLLU4P (ORCPT ); Tue, 12 Dec 2017 15:56:15 -0500 Received: from gateway22.websitewelcome.com ([192.185.47.48]:24518 "EHLO gateway22.websitewelcome.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752303AbdLLU4M (ORCPT ); Tue, 12 Dec 2017 15:56:12 -0500 Date: Tue, 12 Dec 2017 14:56:09 -0600 Message-ID: <20171212145609.Horde.zboC_W8fLQM1eCRt3CdB_QU@gator4166.hostgator.com> From: "Gustavo A. R. Silva" To: Zhenyu Wang Cc: Zhi Wang , Jani Nikula , Joonas Lahtinen , Rodrigo Vivi , David Airlie , intel-gfx@lists.freedesktop.org, intel-gvt-dev@lists.freedesktop.org, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org Subject: Re: [PATCH] drm/i915/gvt/fb_decoder: Fix out-of-bounds read References: <20171209063759.GA8672@embeddedor.com> <20171211092051.stm4eeoa5beigs6d@zhen-hp.sh.intel.com> In-Reply-To: <20171211092051.stm4eeoa5beigs6d@zhen-hp.sh.intel.com> User-Agent: Horde Application Framework 5 Content-Type: text/plain; charset=utf-8; format=flowed; DelSp=Yes MIME-Version: 1.0 Content-Disposition: inline X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator4166.hostgator.com X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - embeddedor.com X-BWhitelist: no X-Source-IP: 108.167.133.22 X-Source-L: Yes X-Exim-ID: 1eOrb0-001fVi-Dn X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: gator4166.hostgator.com [108.167.133.22]:15295 X-Source-Auth: garsilva@embeddedor.com X-Email-Count: 12 X-Source-Cap: Z3V6aWRpbmU7Z3V6aWRpbmU7Z2F0b3I0MTY2Lmhvc3RnYXRvci5jb20= X-Local-Domain: yes Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Zhenyu, Quoting Zhenyu Wang : > On 2017.12.09 00:37:59 -0600, Gustavo A. R. Silva wrote: >> In case function skl_format_to_drm returns -EINVAL, fmt turns into a huge >> number as fmt is of type u32, hence there is an out-of-bounds read when >> using fmt as an index for array skl_pixel_formats at line 225: >> plane->bpp = skl_pixel_formats[fmt].bpp; >> >> Fix this by comparing the value returned by function skl_format_to_drm >> against the size of array skl_pixel_formats, so in case it is greater than >> or equal to the number of items contained in skl_pixel_formats, print an >> error message and return -EINVAL. >> >> Addresses-Coverity-ID: 1462495 >> Addresses-Coverity-ID: 1462502 ("Out-of-bounds read") >> Fixes: 9f31d1063b43 ("drm/i915/gvt: Add framebuffer decoder support") >> Signed-off-by: Gustavo A. R. Silva >> --- >> drivers/gpu/drm/i915/gvt/fb_decoder.c | 6 ++++++ >> 1 file changed, 6 insertions(+) >> >> diff --git a/drivers/gpu/drm/i915/gvt/fb_decoder.c >> b/drivers/gpu/drm/i915/gvt/fb_decoder.c >> index 72f4217..aed578b 100644 >> --- a/drivers/gpu/drm/i915/gvt/fb_decoder.c >> +++ b/drivers/gpu/drm/i915/gvt/fb_decoder.c >> @@ -222,6 +222,12 @@ int intel_vgpu_decode_primary_plane(struct >> intel_vgpu *vgpu, >> val & PLANE_CTL_ORDER_RGBX, >> val & PLANE_CTL_ALPHA_MASK, >> val & PLANE_CTL_YUV422_ORDER_MASK); >> + >> + if (fmt >= ARRAY_SIZE(skl_pixel_formats)) { >> + gvt_vgpu_err("Out-of-bounds pixel format index\n"); >> + return -EINVAL; >> + } >> + >> plane->bpp = skl_pixel_formats[fmt].bpp; >> plane->drm_format = skl_pixel_formats[fmt].drm_format; >> } else { >> -- > > Applied this, thanks! > Glad to help. :) Thanks -- Gustavo A. R. Silva